HCNP-Security-CISN (Huawei Certified Network Professional - Constructing Infrastructure of Security Network) H12-721 Exam Questions with Experts Answers Updated Recently

Note: IKE messages use UDP port 500. When NAT traversal is not enabled, AH and ESP are directly carried over IP. The protocol numbers are 51 and 50 respectively. In the case of NAT traversal, the first phase--messages and destinations of the IKE exchange process use UDP 4500 for both the source port and the destination port. All IKE messages exchanged with the initiator use 4500 ports. If the initiator is inside the NAT, Then NAT changes the source port of the initiator to another port to communicate with other devices. After the first phase of IKE is completed, both parties to the communication know the existence of NAT, and then negotiate whether to use NAT traversal in the SA load of the second phase of IKE, by adding two new encapsulation modes: UDP-tunnel and transmission mode. . An ESP header is encapsulated directly after the UDP header. The source port number and destination port number in the UDP packet header are the same as the IKE protocol. Therefore, it is necessary to check whether the intermediate device blocks protocol numbers 51 and 50, and the packets of UDP 500 and UDP 4500 ports pass. Analysis - because display ike sees no messages, that is, the first phase of IKE is not completed. The correct answer should be AC

Note: By configuring a static fingerprint, the packets that hit the fingerprint are processed accordingly to defend against attack traffic. First, the TCP/UDP/custom service can extract fingerprints based on the payload (that is, the data segment of the packet); second, the DNS packet extracts the fingerprint for the domain name; and third, the HTTP packet is extracted for the Uniform Resource Identifier (URI). fingerprint.